GDPR compliance

Ensure GDPR compliance with my policies for responsibly handling personal data

Skip to main content

As the owner of Luan Nguyen Design, I adhere to the principles of the General Data Protection Regulation (GDPR) in protecting your personal information. The GDPR is a set of regulations aimed at safeguarding the privacy and data of individuals within the European Union (EU) and the European Economic Area (EEA). It establishes guidelines for how personal data should be collected, processed, and stored by organizations.

Ensuring data protection and privacy is crucial because it enhances trust and transparency between individuals and businesses. By following GDPR principles, I prioritize the confidentiality and security of your personal information, aiming to maintain your trust and comply with international data protection standards. If you have any questions or concerns about how I handle your personal data, please do not hesitate to contact me.

1. Data collection and Processing

I collect and process personal data in accordance with the General Data Protection Regulation (GDPR) principles. Personal data is information that can be used to identify you, such as your name, email address, or payment details.

How personal data is collected and processed:

Personal data is collected directly from you when you interact with my website, such as when you register for a course, make a purchase, or contact me with inquiries. Additionally, data may be collected automatically through cookies and similar technologies to improve your browsing experience and analyze website usage.

Legal basis for data processing:

I process your personal data on several legal bases, including:

  • Contractual necessity: Processing is necessary for the performance of a contract with you (e.g., to fulfill orders or provide requested services).
  • Consent: Processing is based on your consent, which you may withdraw at any time.
  • Legal obligations: Processing is necessary to comply with legal obligations (e.g., tax and accounting requirements).
  • Legitimate interests: Processing is necessary for my legitimate interests, such as fraud prevention, network and information security, and improving my services.

I am committed to ensuring that your personal data is processed lawfully, fairly, and transparently. If you have any questions about how I collect or process your personal data, please contact me.

2. User rights

Under the General Data Protection Regulation (GDPR), you have specific rights regarding your personal data. These rights include:

  1. Right of access: You have the right to request access to your personal data that I hold. This enables you to receive a copy of the personal data I hold about you and to check that I am lawfully processing it.
  2. Right to rectification: If you believe that any personal data I hold about you is inaccurate or incomplete, you have the right to request that I correct or update your personal data.
  3. Right to erasure: You have the right to request the deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected, or if you withdraw your consent (where applicable) and there is no other legal ground for processing.
  4. Right to restriction of processing: You have the right to request the restriction of processing of your personal data in certain situations, such as when you contest the accuracy of the data or when you object to processing based on legitimate interests.
  5. Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from me.
  6. Right to object: You have the right to object to the processing of your personal data in certain circumstances, including where I am processing your personal data for direct marketing purposes or based on my legitimate interests.

Procedures for exercising rights:

To exercise any of these rights, please contact me using the contact details provided below. I will respond to your request without undue delay and within one month of receipt, unless an extension is necessary. I may require further information from you to verify your identity before fulfilling your request.

I am committed to respecting and facilitating the exercise of your rights under GDPR. If you have any questions or concerns about how I handle your personal data or wish to exercise your rights, please contact me using the information provided.

3. Data security measures

Ensuring the security of your personal data is a top priority for me. I implement robust measures to protect your information from unauthorized access, disclosure, alteration, or destruction. Here are the security measures I employ:

  1. Encryption: I use encryption protocols, such as SSL/TLS, to safeguard your data during transmission. This ensures that your information remains secure when you interact with my website or services.
  2. Anonymization and Pseudonymization: Where feasible, I anonymize or pseudonymize your personal data to add an additional layer of protection. This means that your data is altered in such a way that it cannot be linked back to you without additional information, reducing the risk in case of unauthorized access.
  3. Access control: I restrict access to your personal data to authorized personnel only. Access is granted based on the principle of least privilege, ensuring that individuals have access only to the data necessary for their specific role.
  4. Data minimization: I collect and retain only the personal data that is necessary for the purposes for which it is processed. This helps minimize the risk associated with the storage and processing of personal information.
  5. Regular security audits: I conduct regular security audits and assessments of my systems and processes to identify and mitigate any vulnerabilities that may pose a risk to your personal data.

By implementing these security measures, I strive to maintain the confidentiality, integrity, and availability of your personal data. Your trust is important to me, and I am committed to continuously improving my security practices to protect your information effectively. If you have any questions or concerns about how I protect your personal data, please contact me using the information provided below.

4. Third-Party data sharing

Ensuring the security and confidentiality of your personal data when shared with third parties is crucial to me. Here’s how I handle third-party data sharing:

  1. Information sharing: I may share your personal data with third parties only when necessary to fulfill the purposes outlined in my Privacy Policy. This includes sharing data with service providers, such as cloud hosting providers or payment processors, who assist me in delivering my services to you.
  2. Contracts and Agreements: Before sharing any personal data with third parties, I establish contracts and agreements that require them to comply with data protection laws and regulations. These contracts outline the specific purposes for which your data may be used and require the third parties to implement appropriate security measures to protect your information.
  3. Data processor oversight: I carefully select and monitor third-party data processors to ensure they meet my stringent data protection standards. This includes regularly assessing their compliance with contractual obligations and conducting audits or reviews as necessary.
  4. Legal basis: Any sharing of your personal data with third parties is based on legal grounds, such as your consent or the necessity to fulfill a contractual obligation with you.

By adhering to these practices, I aim to safeguard your personal data when sharing it with third parties. If you have any questions or concerns about how I share your personal data, please do not hesitate to contact me using the information provided below.

5. Data breach notification

In the event of a data breach, ensuring your prompt notification and taking immediate action are paramount to me. Here’s how I handle data breach notifications:

  1. Notification protocol: If a data breach occurs that compromises your personal data, I will notify you promptly and without undue delay. Notifications will be sent via email or other appropriate means, providing you with details of the breach, the types of information affected, and the steps you can take to mitigate potential harm.
  2. Reporting to authorities: Depending on the severity and legal requirements, I will also report the breach to relevant data protection authorities within the timelines specified by applicable laws and regulations. This ensures compliance and transparency in addressing data security incidents.
  3. Timelines and Procedures: Upon discovering a breach, I will conduct a thorough investigation to assess the scope and impact. Timelines for notification to you and authorities will be based on the nature of the breach and regulatory requirements, aiming for swift and effective communication to minimize risks to your personal data.
  4. Taking action: In addition to notifying you and authorities, I will take immediate steps to mitigate the effects of the breach, secure affected systems, and prevent future incidents. This may include enhancing security measures, reviewing protocols, and providing support as needed to affected individuals.

By following these protocols, I am committed to maintaining the integrity and security of your personal data. If you have any questions or require further information about my data breach notification procedures, please contact me using the details provided below.

6. Compliance documentation

As part of my commitment to GDPR compliance, I maintain thorough documentation to ensure transparency and accountability in handling your personal data:

  1. Documentation of GDPR compliance efforts: I keep detailed records that outline the steps I take to comply with the General Data Protection Regulation (GDPR). This includes policies, procedures, and controls implemented to protect your personal data and uphold your rights under the GDPR.
  2. Records of data processing activities: I maintain comprehensive records of my data processing activities. These records detail the types of personal data collected, the purposes for which they are processed, any third parties with whom data is shared, and the security measures implemented to protect this information.
  3. Purpose of documentation: These records serve as a crucial tool for demonstrating compliance during audits, inspections, or inquiries by data protection authorities. They also enable me to review and assess the effectiveness of my data protection practices and make necessary improvements to safeguard your privacy.
  4. Continuous improvement: I regularly review and update my compliance documentation to reflect changes in regulations, business practices, and technology. This ensures that I maintain high standards of data protection and privacy in all aspects of my operations.

If you have any questions or require access to specific documentation regarding my GDPR compliance efforts, please contact me using the details provided below. Your trust and confidence in how I handle your personal data are of utmost importance to me.

7. Contact me

For any inquiries related to GDPR or data protection, please reach out using the following contact information:

I am here to support you with any questions or concerns you may have regarding the protection of your personal data. Your privacy matters, and I am committed to providing transparency and assistance regarding GDPR compliance and data protection matters.